PhpGedView / Discussion / Open Discussion: Critical PHP vulnerabilities (PHP2Shell)

frenchie - 2 days ago

Hi all
What do we need to do to keep us safe from this vulnerability? What's the recommended PHP-version for the latest phpGedView?

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gerry Kroll - 2 days ago

The most recent version of PhpGedView is available as an SVN snapshot. Follow the "SVN" link at the top of this page.

The current SVN release is 7390, dated 2026-09-15. It works with PHP version 8.2, and as far as I know, it works with PHP 8.4 too, but I haven't personally tested that.

I've not seen any bug reports about PGV running with PHP versions more recent than 8.2

I would avoid PHP version 9: the PHP developers have a history of "improving" the language, and in the process breaking existing programs. The implementation of PHP 8 was a disaster for me: hundreds of errors and warnings. Not nice at all. It cost me about 400 hours of needless work.

I don't think PGV is vulnerable, but I'm open to being educated.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Tomasz Babczyński - 2 days ago
  
  Hi all,
  It is not pgv vulnerability, it is deeper - the PHP itself is critically vulnerable. No matter what is served.
  The versions patched are: 8.4.27, 8.5.15. The patched versions are available since 21.10.26, yesterday. I don't know the numbers for 8.3 and 8.2. Versions below these will be not patched as not maintained!
  
  T. B.
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
  - Tomasz Babczyński - 2 days ago
    
    Update:
    the patched versions list:
    PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities
    that can allow unauthenticated remote code execution. All PHP users are
    strongly encouraged to update immediately.
    
    PHP 8.1 and older no longer receive updates from the PHP project.
    
    https://www.php.net/archive/2026.php#2026-10-21-5
    
    T.B.
    
    If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Gerry Kroll - 2 days ago

I received a message from the Matomo developers where they recommend these PHP versions:

PHP 8.58.5.12 or PHP 8.48.4.27 or PHP 8.38.3.36 or PHP 8.28.2.35

As I said before, PGV may work with PHP 8.5. I haven't seen any reports of problems with PGV running under that version.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

frenchie - 16 hours ago

I bumped up my webhotell to 8.4.26 and phpGedView works perfect. The host management has made backdrop-updates so we're safe for now.

Last edit: frenchie 16 hours ago

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Tomasz Babczyński - 14 hours ago
  
  8.4.26 is not enough, 27 is the safe version.
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Critical PHP vulnerabilities (PHP2Shell)

Forums

Help

Critical PHP vulnerabilities (PHP2Shell)

Critical PHP vulnerabilities (PHP2Shell)

Forums

Help

Critical PHP vulnerabilities (PHP2Shell) document.SUBSCRIPTION_OPTIONS = { "thing": "topic", "subscribed": false, "url": "subscribe", "icon": { "css": "fa fa-envelope-o" } };

Critical PHP vulnerabilities (PHP2Shell)